Experimental Quantum Key Distribution with Decoy States 
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To increase dramatically the distance and the secure key generation rate of quantum key dis- 
tribution (QKD), the idea of quantum decoys — signals of different intensities — has recently been 
proposed. Here, we present the first experimental implementation of decoy state QKD. By making 
simple modifications to a commercial quantum key distribution system, we show that a secure key 
generation rate of 165bit/s, which is 1/4 of the theoretical limit, can be obtained over 15km of a 
Telecom fiber. We also show that with the same experimental parameters, not even a single bit of 
secure key can be extracted with a non-decoy-state protocol. Compared to building single photon 
sources, decoy state QKD is a much simpler method for increasing the distance and key generation 
rate of unconditionally secure QKD. 

PACS numbers: 



Quantum key distribution (QKD) 0, was proposed 
as a method of achieving perfectly secure Communica- 
tions. Any eavesdropping attempt by a third party will 
necessarily introduce an abnormally high quantum bit 
error rate in a quantum transmission and thus be caught 
by the users. With a perfect single photon source, QKD 
provides proven unconditional security guaranteed by the 
fundamental laws of quantum physics [3, H ■ 

Most current experimental QKD set-ups are based on 
attenuated làser pulses which occasionally give out multi- 
photons. Therefore, any security proofs must take into 
account the possibility of subtle eavesdropping attacks, 
including the PNS (photon number splitting) attack 
A hallmark of those subtle attacks is that they introduce 
a photon-number dependent attenuation to the signal. 

Fortunately, it is still possible to obtain uncondition- 
ally secure QKD, even with (phase randomized) attenu- 
ated làser pulses, as theoretically demonstrated by [(| and 
Gottesman-Lo-Lütkenhaus-Preskill (GLLP) 0- How- 
ever, one must pay a steep price by placing severe limits 
on the distance and the key generation rate. See also 

A key question is this: how can one extend the dis- 
tance and key generation rate of secure QKD? A brute 
force solution to this problem would be to use a (nearly) 
perfect single photon source. Despite much experimental 
effort @, reliable perfect single photon sources are far 
from practical. 

Anothcr solution to increase the transmission distance 
and key generation rate is to employ decoy states, using 
extra states of different average photon number to detect 
photon-number dependent attenuation. It has attracted 
great recent interests. The decoy method was first dis- 
covered by Hwang ^(j ■ I n Ell > we presented the first rig- 
orous security proof of decoy state QKD. We showed that 
the decoy state method can be combined with Standard 
GLLP result to achieve dramatically higher key genera- 
tion rates and distances. Moreover, we proposed practi- 
cal protocols with vacua or weak coherent states as de- 
coys. Subsequently, the security of practical protocols 



have been analyzed by Wang [Ï3| and us [Ï3j]. See also 
[Ï4| . In particular, we pi demonstrated theoretically 
the clear practicality of decoy state QKD using only one 
decoy state. We call such a protocol a one-decoy proto- 
col. 

However , un til now, all decoy state QKD papers 0, 
Il·ll Ha . lla . Il4| have been theoretical and there has been 
no experimental dcmonstration. Here, we present, for 
the first time, an experimental realization of decoy state 
QKD. 

We remark that additional errors will appear in exper- 
imental implementation of a decoy state protocol. An 
example of a source of additional errors is intensity mod- 
ulation, which, as will be discussed below, is required 
for the implementation of decoy state QKD. Those ad- 
ditional errors will change the parameters and, thus, the 
quantitative results in the simulations done in previous 
papers 0,0,0]- Therefore, to quantify the advantage 
of decoy state QKD in practice, it is crucial to perform 
a real experiment and analyze the data obtained experi- 
mentally. 

In our experiment, we use acousto-optic modulators 
(AOM) to achieve polarization insensitive modulation, 
which is important for our set-up. While already used 
in telecommunications, we believe that this is the first 
time that AOMs have been introduced in a QKD exper- 
iment. In summary, our experiment demonstrates a new 
approach — decoy state QKD — with a new experimental 
component — AOM — in QKD. 

We will first discuss the GLLP result and how the de- 
coy state method can be combined with GLLP to achieve 
high key generation rate and distance. The GLLP 7] 
method can be used to prové the security of QKD based 
on a phase randomized weak coherent state source. With 
the GLLP method the secure key generation rate, which 
is defined as the ratio of the length of the secure key to 
the total number of signals sent by Alice, is given by ^3 



R > qi-QnfiEjHiíEp) +Qi[l - H 2 ( ei )]}, (1) 



where q depends on the protocol 0, the subscript \i is 
the average photon number per signal in signal states, 
is the gain 16] of signal states, is the quantum 
bit error rate (QBER) of signal states, Q\ is the gain of 
the single photon states (i.e., the probability that Alice 
generates exactly a single photon which is finally detected 
by Bob) in signal states, e\ is the error rate of single 
photon states in signal states. f(x) is the bi-directional 
error correction rate , and H 2 (x) is the binary entropy 
function: H 2 (x) = —x\og 2 (x) — (1 — ir)log 2 (i — x). 
and can both be measured directly from experiments, 
while Qi and e\ have to be estimated (because we could 
not measure the photon number of each pulse) . 

Owing to the loss in a fiber, its length determines the 
gains and QBERs (as denoted by Q^Qx, -E M ,ei) and 
therefore, the key generation rate R. At the distance 
where the key generation rate R hits zero, the QKD 
protocol is no longer secure (with the Standard classical 
post-processing protocol which uses only one-way classi- 
cal Communications). 

Clearly, to estimate key generation rate, the main task 
is to estimate a lower bound of Q\ and an upper bound 
of ex. However, in non-decoy state approaches, the es- 
timations are quite poor. This is the reason why, with 
non-decoy state approaches, QKD can be proven to be 
secure only at very limited key generation rate and dis- 
tance. While experimental QKD has been demonstrated 
at 122km in telecom fibers 01 > most of the previous 
experiments do not appear to satisfy the strict secu- 
rity analysis demanded in non-decoy approaches 0, El • 
Given that security is the most crucial issue in QKD, this 
is a highly unsatisfactory situation. 

Fortunately, decoy state QKD comes to the rescue. As 
discussed below, decoy state QKD allows dramàtic im- 
provement in our estimations of Qi and ex, compared 
to non-decoy approaches. The bàsic idea of decoy state 
QKD is as follows: in addition to the signal state with 
average photon number /i, one introduces some "decoy" 
states with some other average photon numbers Vi and 
blends signal states with decoy states randomly on Alice's 
side [2(J. For instance, in a one-decoy state protocol [Ï3| . 
the average photon number of a decoy state is much lower 
than that of the signal state. After Bob's acknowledge- 
ment of receipt of signals, Alice broadcasts which pulses 
are signal states and which are decoy states. Alice and 
Bob can, therefore, analyze the statistical characteristics 
(i.e., transmittance and QBER) of each type of signal 
separately. Since one assumes all characteristics (except 
photon number distribution) of the signal state and the 
decoy state are the same, Eve's eavesdropping attack can 
depend on the actual photon number in each pulse, but 
she has no knowledge which state (signal or decoy) the 
pulse is in. Eve's attack will modify the characteristics 
(transmittance or QBER) of decoy states and/or signal 
states and will be caught. For instance, in a one-decoy 
state protocol, if Eve introduces a photon-number de- 
pendent attenuation to the channel, then the transmit- 
tance of the decoy state (which has a much lower average 
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FIG. 1: Schematic of the experimental set-up in our system. 
Inside Bob/Jr. Alice: components in Bob/Alice's package of 
id Quantique QKD system. Our modifications: CA: Com- 
pensating AOM; CG: Compensating Generator; DA: Decoy 
AOM; DG: Decoy Generator. Original QKD system: LD: 
làser diode; APD: avalanche photon diode; phase mod- 
ulator; PBS: polarization beam splitter; PD: classical photo 
detector; DL: Delay line; FM: faraday mirror. Sòlid line: 
SMF28 single mode optical fiber; dashed line: elèctric cable. 



photon number than the signal state) will generally be 
much lower than what Alice and Bob would expect un- 
der normal operations. Note that decoy states are used 
only for catching an eavesdr opp er, but not for key gerl- 
eration. It has been shown [l·lT IÏ2L IT^ | that, in theory, 
decoy state QKD can substantially enhance security and 
performance of QKD. 

Before describing our experiment, we would like to 
point out that if one already had a uni-directional QKD 
system [^J in place, the implementation of decoy 
state QKD would have been much easier: one can simply 
drive the làser source directly to various power levels. 

Modified "Plug and Play" set-up: Unfortunatcly, most 
existing commercial QKD systems are bi-directional 
( "Plug & Play" ) in the sense that Bob sends out a chain 
of strong signals to Alice, who attenuates each signal to 
single photon level and modulates (i.e., encodes quantum 
information on) it before sending it back to Bob, who per- 
forms the measurement (i.e., decoding of quantum infor- 
mation), after which a new chain of strong signals will 
be sent to Alice. Therefore, the intensity modulation by 
Alice has to be carefully synchronizcd with Bob's làser 
source. 

Here, we show that, even with such a commercial sys- 
tem (manufactured by id Quantique in our current set- 
up) , one can successfully implement decoy state QKD by 
making simple modifications. 

Our Experiment: FIG. ^ illustrates the schematic of 
our system. The commercial QKD system consists of 
Bob and Jr. Alice. In our experiment, Alice consists of 
Jr. Alice and four new optical and elèctric components: 
an AOM (DA in FIG. 1), a function generator (DG in 
FIG. 1), a compensating AOM (CA in FIG. 1) and a 
compensating generator (CG in FIG. 1). Their functions 
will be discussed below. 

We implement the one decoy state protocol proposed 
by our group in on top of the Standard BB84 ^ pro- 
tocol. In a one decoy state protocol, Alice must randomly 
modulate the intensity of each signal to either signal state 
level or decoy state level before sending it back to Bob. 
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We add an AOM (DA in FIG. d) on Alice's side. A func- 
tion generator (DG in FIG.QJ controls the transmittancc 
of the AOM. 

A critical issue in our set-up is to compensate the phase 
shift due to our AOM. Since the Mach-Zehnder Interfer- 
ometer (MZI) on Bob's side is asymmetric, the frequency 
shift introduced by AOM causes a significant phase shift 
between the two pulses that go through different arms of 
MZI. To compensate this phase shift, another AOM, the 
"Compensating AOM" (CA in FIG. [TJ is employed to 
make the total phase shift múltiples of 2ir. This AOM is 
driven by the second function generator, "Compensating 
Generator" (CG in FIG.QJ 22]. 

Optimization of Parameters: We perform a numerical 
simulation with parameters of our set-up [2j| and 
optimally set /x and v to 0.80 and 0.12 photons respec- 
tively. The actual distribution of the states is produced 
by an id Quantique Quantum Random Number Gener- 
ator. Around 10% of the signals are assigned as decoy 
states, which is optimal according to numerical simula- 
tion |l3j |. This random pattern is generated and loaded 
to the Decoy Generator before the experiment [24[ . 

Except for the modulation period, the transmittance 
of Decoy AOM (DA) is set to maximum. As the classi- 
cal detector (PD in FIG. ^) inside Alice detects the first 
pulse from Bob, it triggers the Decoy Generator (DG). 
The Decoy Generator (DG) will then hold a delay time 
td before outputting the random pattern to modulate dif- 
ferent states. The Compensating AOM (CA) is used only 
for the purpose of phase compensation. Thus, its trans- 
mittance is set to be constant. 

Recali that each signal in a "Plug and Play" set up 
consists of two time-separated pulses. To keep visibility 
high, the two pulses of the same signal must be attenu- 
ated equally, which means the delay time must be very 
precise. In our experiment, the delay time was deter- 
mined with an accuracy of lOns. 

In our experiment, a total of N = 105M raw bits (in- 
cluding both signal states and decoy states) were sent 
using quantum key distribution from Alice to Bob. The 
transmitting time was less than four minutes. 

After the transmission of all the N signals, Bob an- 
nounced which signals had actually been received by him 
and in which basis. Alice broadcasted to Bob the distri- 
bution of decoy states as well as basis information. Wc 
assume Alice and Bob announced the measurement out- 
comes of all decoy states as well as a subset of the signal 
states. From those experimental data, Alice and Bob 
then determined Q^, Q v E^, and E v , whose vàlues are 
now listed in Table|I| 

Analysis of Experimental Results: Alice and Bob have 
to derive a lower bound on the key generation rate, R, by 
applying the theory of one decoy state protocol to their 
experimental data. To begin, we discuss the theory of 
one decoy state protocol. The one-decoy state protocol 
was first proposed in |ll| and analyzed in [Ï3| . In such a 
protocol, only one decoy state is used (in principle, more 
decoy states might increase key generation rate) whose 



average photon number is v. The transmittance/gain of 
the decoy state Q v and its error rate E v could also be 
acquired directly from experiments. Taking statistical 
fluctuations into account, the lower bound of Q%, and 
the upper bound of e\ are given by 01 



ei < e\ 
in which 



\w — 
u _ E^Q^ 



(2) 



(3) 



where N v is the number of pulses used as decoy states 
PH . and eo (=1/2) is the error rate for the vacuum signal 
and therefore the lower bound of key generation rate is 

R>R L = qi-QnKEjH^E») +Qf[l - H 2 (e^)]} (4) 

In our analysis of experimental data, we estimated ei 
and Qi very conservatively as within 10 Standard devia- 
tions (i.e., u Q =10), which promises a confidence interval 
for statistical fluctuations of 1 — 1.5 x 10 -23 . 

The experimental results listed in Table are the in- 
puts for Eqs. (2-4), whose output is a lower bound of 
the key generation rate, as shown in Table lïïl Even with 
our very conservative estimation of ei and Q\, we got a 
lower bound for the key generation rate R L = 3.6 x 10~ 4 
per pulse, or 165bits/s, which means a final key length 
of about L = NR ~ 38kbit. We also calculated i? per / ec t, 
the theoretical limit from the case of infinite data size 
and infinite decoy states protocol, by using Eq. (1). We 
remark that our lower bound R L is indeed good because 
it is roughly 1/4 of R per fect- This fact suggests that it 
is not necessary, or rather, not economical to use eithcr 
a very large quantity of data or a lot of different decoy 
states. 

Based on the method described in 0, lïïl IÏ3 , w e care- 
fully performed numerical simulations with |23j. Wc 
found that without decoy method, no matter what value 
of (i we choose or how large the data size we use, the 
key generation rate, R, will hit zero at only 9.6km. In 
other words, at 15km, not even a single bit could bc 
shared between Alice and Bob with guaranteed security. 
In contrast, our numerical simulations show that, with 
decoy states, our QKD set-up can be made secure over 



Para. Value 


Para. 


Value 


Para. 


Value 


Q„ 8.757 x IÓ' 4 




9.536 x KT 3 




0.4478 


Q v 1.360 x 10~ 3 


E v 


2.689 x 1(T 2 


f{E„) [12 


<1.22 



TABLE I: Experimental data and somc parameters we used in 
our experiment. As required by GLLP [jj, bit vàlues for dou- 
ble detections are assigned randomly by the quantum random 
number generator. 
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50km, which is substantially larger than the secure dis- 
tance (9.6km) without decoy states. 

In summary, we have performed the first experimental 
demonstration of decoy state QKD, over 15km of Tele- 
com fibers. Our experiment shows that, with rather sim- 
ple modifications (by adding commercial acousto-optic 
modulators, AOM) to a commercial QKD system, decoy 
method allows us to achieve much better performance 
with substantially higher key generation rate and longer 
distance than is otherwise possible. We conclude that, 
with careful conceptual design and optimization, decoy 
state QKD is casy to implcment in experiments. It is, 
therefore, ready for immediate commercial applications. 
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Para. Value 


Para. Value 


QÍ 2.140 x 10' 
eï 3.902 x 10~ 2 


R L 3.588 x 10" 4 
R perfect 1.418 x IÓ" 3 



TABLE II: The lower bounds of Qi , R and the upper bound of 
e\. The vàlues are calculated from Eqs. (2-4). As a compari- 
son, we also gave the theoretical limit, R per fect- It represents 
the situation of infinitely long data size and infmitely many 
decoy states. Our result shows that even a simple one decoy 
state protocol can achieve one fourth of the theoretical limit. 



[1] C. H. Bennett, G. Brassard, Proceedings of IEEE Inter- 
national Conference on Computers, Systems, and Signal 
Processing, (IEEE, 1984), pp. 175-179. 

[2] A. K. Ekert, Phys. Rev. Lett. 67 661 (1991) 

[3] D. Mayers, J. of ACM 48, 351 (2001); H.-K. Lo, H. F. 
Chau, Science, 283, 2050 (1999); E. Biham et al. Pro- 
ceedings of the Thirty-Second Annual ACM Symposium 
on Theory of Computing (STOC'00) (ACM Press, New 
York, 2000), pp. 715-724; P. W. Shor, J. Preskill, Phys. 
Rev. Lett. 85, 441, (2000) 

[4] K. Ekert, and B. Huttner, J. of Modern Òptics 41, 2455 
(1994); D. Deutsch et al, Phys. Rev. Lett. 77, 2818 
(1996); Erratum: Phys. Rev. Lett. 80, 2022 (1998). 

[5] Eve can selectively surpress all the single photon signals 
from Alice, and split all the multi photon signals, keep- 
ing one copy herself and send the other copy to Bob. In 
this way, Eve could have an identical copy of what Bob 
processes, thus breaking the security of BB84 protocol. 
Although such attacks may appear to be beyond cur- 
rent technology, the first rule in cryptography is: never 
underestimate the determination and ingenuity of your 
opponents in breaking your codes. 

[6] H. Inamori, N. Lütkenhaus, D. Mayers, in press (available 
at http:/ /arxiv.org/abs/quant-ph/0107017) 

[7] D. Gottesman et al. Quantum Information and Compu- 
tation 4, 325 (2004) 

[8] M. Koashi, available at 

http://arxiv.org/abs/quant-ph/0403131 ; V. Sacarani 
et al. Phys. Rev. Lett. 92 057901, K. Inoue et al. Phys. 
Rev. A 71 042305, M. Curty et al. Phys. Rev. A 69 
042321 

[9] J. McKeever, et al. Science 303, 1992 (2004); Z. L. Yuan, 

et al, Science 295, 102 (2002); M. Keller et al. Nature 

431, 1075 (2004) 
[10] W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003) 
[11] H.-K. Lo, in Proceedings of IEEE ISIT 2004, P- 137; 

H.-K. Lo, X. Ma, K. Chen, Phys. Rev. Lett. 94 230504 

(2005). 

[12] X. -B. Wang, Phys. Rev. Lett. 94 230503 (2005); X. -B. 
Wang, Phys. Rev. A 72 012322 (2005) 



[13] X. Ma et al. Phys. Rev. A 72 012326 (2005) 

[14] J. W. Harrington et al. in press (available at 
http: / /arxiv.org/abs / quant-ph/0503002 ) 

[15] Our experimental implementation is based on BB84 pro- 
tocol. In the cases that Alice and Bob use the same basis, 
pulses are used as signal states. Factor q in Eq. Q 
is thus given by q = /N. 

[16] The gain is defined to be the ratio of the number of re- 
ceiver Bob's detection events to the number of signals 
emitted by sender Alice in the cases where Alice and Bob 
use the same basis. 

[17] G. Brassard, L. Salvail, Advances in Cryptology EIJRO- 
CRYPT '93, Vol. 765 of Lecture Notes m Computer Sci- 
ence, (Springer, Berlin, 1994), pp. 410-423. 

[18] C. Gobby, Z. L. Yuan, A. J. Shields, Appl. Phys. Lett. 84 
3762 (2004) 

[19] Many existing QKD experiments take an ad hoc value of 
0.1 for the average photon number of the signal. Besides, 
few of them have considered the most general eavesdrop- 
ping attack allowed by quantum mechanics. 

[20] Here, we assume that the source emits coherent states 
and the phases of all states (signals or decoys) are ran- 
domized. Therefore, the photon number of the signal 
state follows a Poissonian distribution with a parame- 
ter /i whereas that of a decoy state follows a Poissonian 
distribution with a parameter Vi. 

[21] The same strategy fails miserably for a bi-directional 
QKD system because Eve can easily monitor the inten- 
sity of the ancillary strong signal originated from Bob. 

[22] Given a variable frequency driver for DA (which is also 
commercially viable), CA and CG could be taken off. 

[23] Làser A = 1550nm at 5MHz, background rate Yo = 2.11 x 
10~ 5 , fiber loss 0.21dB/km, Bob's quantum efnciency 
»7boï)=0.0227, detector error rate edetector = 8.269 x 10 . 

[24] In principle, for perfect security, a new random pattern 
should be chosen for each frame. For ease of implemen- 
tation, in our experiment, the same pattern was reused 
for every frame. Note, however, that each signal within a 
frame was still modulated individually. 

[25] This is because in our experiment, the yield for the cases 



■5 



that Alice and Bob use the same basis is the same as that 
for the cases that they use different basis. 



